SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityAnalyzed

CVE-2023-6764

A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from…

HIGH 8.1EPSS 0.89%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.89%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected device’s memory layout and configuration.

CVSS 3.1
8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.89% probability · 57th percentile
CISA KEV
Not listed
Weakness
CWE-134
Affected
zyxel/atp100 firmware · zyxel/atp100w firmware · zyxel/atp200 firmware · zyxel/atp500 firmware · zyxel/atp700 firmware · zyxel/atp800 firmware · zyxel/usg flex 100 firmware · zyxel/usg flex 100ax firmware · zyxel/usg flex 100h firmware · zyxel/usg flex 100w firmware · zyxel/usg flex 200 firmware · zyxel/usg flex 200h firmware · zyxel/usg flex 200hp firmware · zyxel/usg flex 500 firmware · zyxel/usg flex 500h firmware · zyxel/usg flex 700 firmware · zyxel/usg flex 700h firmware · zyxel/usg flex 50 firmware · zyxel/usg flex 50w firmware · zyxel/usg20-vpn firmware · +1 more
Source
security@zyxel.com.tw

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.